2 Answers
2

Yes, libpcap 1.0 and later do it, although later versions of libpcap have fixed a number of bugs, so the later the version of libpcap being used, the better it works. Code written to the standard libpcap APIs will use zero-copy capturing on Linux with libpcap 1.0 and later.

(Netsniff-ng has its own code to capture packets, rather than using libpcap.)